Hacker News new | past | comments | ask | show | jobs | submit login

> I wonder if certificate transparency could be mandated for intermediate certificates sooner than a full DV rollout could.

It should be mentioned that Certificate Transparency would not have prevented this attack (nor any other such attack).

Google has nothing to gain from CT beyond where they are right now: knowing who issued the cert.

Details: https://blog.okturtles.com/2014/09/the-trouble-with-certific...

TLDR: https://github.com/okTurtles/dnschain/blob/master/docs/Compa...




Not this particular attack, as this was a test intermediate only valid for 2 weeks, but the attack was limited to an internal corporate network. For other cases it would allow browser vendor to demand audit reports for example.


So, as mentioned in the first link, client audits via the browser would do absolutely nothing during an attack:

"None of CT’s proofs (audit or consistency proofs) will detect mis-issuance of a certificate by a rogue CA, not even if gossip of STHs (signed-tree-heads) successfully occurs [1]"

And that's for today's attacks. In the section before that paragraph, another attack is demonstrated that also cannot be prevented by CT's audit proofs.

[1] https://moderncrypto.org/mail-archive/messaging/2014/000873....


And the point is that logging intermediates only does not directly prevent the attacks but it is still useful.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: